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DETAILED ACTION 

f 

1 . This action is in response to the preliminary amendment filed September 30, 
2004. 

2. Claims 1-4, 39, and 43 have been amended and new claims 89-97 have been 
added. 

3. Claims 1-97 have been examined and are pending with this action. 



Claim Objections 

4. Claims 94 and 97 is objected to under 37 CFR 1 .75(c), as being of improper 
dependent form for failing to further limit the subject matter of a previous claim. 
Applicant is required to cancel the claim(s), or amend the claim(s) to place the claim(s) 
in proper dependent form, or rewrite the claim(s) in independent form. Claim 94 
reiterates what has been already claimed in claim 39 and claim 97 reiterates what has 
been already claimed in claim 43. 
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Claim Rejections - 35 USC §112 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly 
claiming the subject matter, which the applicant regards as his invention. 

5. Claim 2 recites the limitation "said gathering" and "said web services application" 
in page 2 of 22 of the preliminary amendment. There is insufficient antecedent basis for 
these limitations in the claim. 

Claim 3 recites the limitation "said web services application" in page 2 of 22 of 
the preliminary amendment. There is insufficient antecedent basis for this limitation in 
the claim. 

Claim 8 recites the limitation "said first message" in page 4 of 22 of the 
preliminary amendment. There is insufficient antecedent basis for this limitation in the 
claim. 

Claims 24 and 25 recites the limitation "said web services application" in page 7 
of 22 of the preliminary amendment. There is insufficient antecedent basis for this 
limitation in the claim. 

Claim 35 recites the limitation "said web services application" in page 8 of 22 of 
the preliminary amendment. There is insufficient antecedent basis for this limitation in 
the claim. 

Claim 36 recites the limitation "said web services application" in page 9 of 22 of 
the preliminary amendment. There is insufficient antecedent basis for this limitation in 
the claim. 
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Claim 90 recites the limitation "said gathering" in page 20 of 22 of the preliminary 
amendment. There is insufficient antecedent basis for these limitations in the claim. 

Claim 91 recites the limitation "said web services application" in page 21 of 22 of 
the preliminary amendment. There is insufficient antecedent basis for this limitation in 
the claim. 



Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 

6. Claims 1-3, 8-13, 15-17, 24-36, 39-49, 54-59, 61-63, 70-82, 85-92, and 94-97 are 
rejected under 35 U.S.C. 102(b) as being anticipated by Post (US 5,822,527 A). 

As per claims 1, 47, and 89, Post teaches a method and computer program 
product including executable code for filtering data from a data stream of a distributed 
computing system that includes a web services application comprising: receiving a 
message on the data stream (see col.2, line 54) that is associated with the web service 
application (inherent: see col.1, line 15 and col. 3, line 46: "electronic mail"); evaluating, 
using data from the message, a current set of one or more rules producing a current set 
of evaluated rules (see col.2, lines 27-34 & 54-64); and collecting data associated with 
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the message in accordance with the current set of evaluated rules (see col. 2, lines 34- 
36 & 65-67). 

As per claims 2, 48, 90, and 91 , Post teaches wherein said evaluating and said 
gathering are performed in real-time while said web services application is servicing 
requests (see col.1 , lines 19-27: "streams"), and the method further comprising: 
performing, by said web services application, a service in accordance with said 
message (see col. 3, line 63-col.4, line 6). 

As per claims 3, 49, and 92, Post teaches of further comprising: specifying a first 
set of rules; and specifying a second set of rules in real-time while said web services 
application services requests and filters data from said web services application's data 
stream, said second set of rules replacing said first set of rules as said current set of 
rules (see Fig.3, steps 31 4-320 and steps 31 4-326). 

As per claims 8 and 54, Post further teaches wherein each rule in said first set of 
rules has a condition portion and an associated action portion, and the method further 
comprising: extracting one or more data items using said first message (see col.2, lines 
28-30 & 59-60 and col. 8, lines 13-18); evaluating each condition portion in accordance 
with said one or more data items (see col.2, lines 30-34 & 60-64 and col .7, lines 8-12); 
and for each condition portion evaluating to true, performing said associated action 
portion (see Fig.3, steps 320-324 and col.2, lines 34-36 & 64-67). 

As per claims 9 and 55, Post further teaches wherein said one or more data 
items include at least one of: message origin information (see col .3, lines 58-62), 
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message header information, web service methods, message parameter, message 
metadata, and authentication and authorization data. 

As per claims 10 and 56, Post further teaches wherein said associated action 
portion includes performing at least one of: outputting data, executing an application, 
and sending a message (see col.4, lines 57-61). 

As per claims 1 1 and 57, Post further teaches wherein said associated action 
portion includes executing an application and said application is one of: a customized 
application and an e-mail application (see col.1, line 15 and col.3, line 46). 

As per claims 12 and 58, Post further teaches wherein said associated action 
portion includes sending a message and said message sent is one of: an e-mail 
message, and a message in accordance with a predefined protocol (implicit: see col.1, 
line 15; col.3, line 46; and col.4, lines 3-6). 

As per claims 13 and 59, further teaches wherein said associated action portion 
includes performing at least one of: rejecting a request, and transferring control to an 
application in accordance with at least one compliance condition (see col.7, lines 51-53; 
col.9, lines 12-32; and col. 12, line 9). 

As per claims 1 5 and 61 , Post further teaches wherein said associated action 
portion includes outputting data to at least one of: an event log, a system log, an error 
log, and a file included in a file system (see col. 5, lines 48-51 ). 

As per claims 16 and 62, teaches of further comprising: synchronizing access to 
a commonly accessed resource in accordance with said associated action portion (see 
col.9, lines 12-32). 



Application/Control Number: 10/649,160 Page 7 

Art Unit: 2155 

As per claims 17 and 63, Post teaches of further comprising: concurrently 
accessing a commonly accessed resource in accordance with said associated action 
portion (see col. 1, lines 21-22). 

As per claims 24 and 70, Post further teaches wherein said web services 
application is one of a plurality of applications providing web services (inherent: see 
col .2, lines 3-4). 

As per claims 25 and 71 , Post further teaches wherein said web services 
application is associated with an application server and a stream sensor, said stream 
sensor performing said evaluating (see col. 8, lines 1-5). 

As per claims 26 and 72, Post teaches of further comprising: using a console to 
specify said current set of rules (see col. 6, lines 36-40). 

As per claims 27 and 73, Post teaches of further comprising: using a non- 
interactive input source to specify said current set of rules (see col. 6, lines 40-43). 

As per claims 28 and 74, Post teaches of further comprising: selecting at least 
one condition (see col. 7, lines 51-53) and at least one data item included in said current 
set of rules (see col.7, lines 13-18). 

As per claims 29 and 75, Post further teaches wherein said evaluating each 
condition portion further comprises: performing expression processing in accordance 
with said one or more data items (see col. 10, lines 17-22). 

As per claims 30 and 76, Post teaches of further comprising: performing format 
processing in connection with outputting data for an action portion of a rule when a 
condition portion of said rule evaluates to true (see col.9, lines 59-62). 
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As per claims 31 and 77, Post further teaches wherein each rule of said current 
set of one or more rules includes a condition portion (see col. 7, lines 51-53) and an 
action portion, said action portion being performed if said condition portion evaluates to 
true (see col.7, lines 51-65). 

As per claims 32 and 78, Post further teaches wherein said condition portion 
includes a reference to a user-defined routine (see col. 5, lines 34-40). 

As per claims 33 and 79, Post further teaches wherein said action portion 
includes outputting data to an output destination, and the method further comprising: 
outputting first data to a first output destination executing a first routine in accordance 
with a first condition; and outputting second data to a second output destination 
executing a second routine in accordance with a second condition, said first output 
destination being different from said second output destinations (see col.3, lines 53-65). 

As per claims 34 and 80, Post further teaches wherein said first routine outputs 
first data to a third routine which aggregates said first data and outputs aggregated first 
data at predetermined time intervals to a third output destination different from said first 
and second output destinations (subjective: see col. 9, lines 33-47). 

As per claims 35 and 81 , Post further teaches wherein said message received is 
one of: an input message and an output message of said data stream of said web 
services application (see col.4, lines 7-10 and col. 13, lines 28-30). 

As per claims 36 and 82, Post further teaches wherein a plurality of messages 
(see Fig.1 ) are received and said plurality of messages include at least one input 
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message and at least one output message of said data stream of said web services 
application (see claims 35 and 81 rejection above). 

As per claim 39, Post teaches a system for filtering data comprising: at least one 
application providing a service; at least one application server and stream sensor 
associated with each of said at least one application, said stream sensor filtering a data 
stream of said at least one application in accordance with a dynamically evaluated (see 
col. 6, lines 10-25) current set of rules producing filtered data, said current set of rules 
being dynamically evaluated with each received message (see Fig.1; Fig.3; col.2, lines 
28-36 & 59-67; and col.4, line 57-col.5, line 5); and a context engine associated with 
each of said at least one application, said context engine including an aggregation 
service that aggregates said filtered data for said application in accordance with at least 
one local aggregation condition (see Fig.3, steps 320-326 and col.7, lines 65-67). 

As per claim 40, Post further teaches wherein said filtered data is stored in raw 
data files used as input to said aggregation service which output summary data (see 
col.1 f lines 31-43). 

As per claim 41 , further teaches wherein the system includes at least one 
application and a global aggregator gathering output summary data from each 
aggregation service associated with each of said at least one application (see col. 9, 
lines 12-17). 

As per claim 42, Post further teaches wherein said local aggregation condition is 
aggregating data locally for each transaction (inherent: see Fig.3). 
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As per claims 43, 85, 95, and 97, Post teaches a method for capturing data from 
a data stream of an application comprising: receiving a first message from said data 
stream of said application (see Fig.1, #102); storing first context information represents 
including a copy of a first set of one or more rules, said first context information 
describing a processing state of said first message used during a first processing 
lifetime of said first message, said first set of one or more rules used in obtaining first 
data related to said first message, said first set of one or more rules being identified as 
a current set of rules (see col.3, line 53-65 and col.4, lines 1 1-25); defining a second set 
of one or more rules at runtime of said application while said application is servicing a 
request such that any subsequently received messages are processed in accordance 
with said second set of one or more rules, said second set of one or more rules 
replacing said first set of one or more rules as current set of rules (see Fig.3, steps 314- 
320); receiving a second message from said data stream (see Fig.1, #104) during said 
first processing lifetime of said first message (see col.1 , lines 21-24); and storing 
second context information represents including a copy of said second set of one or 
more rules, said second context information describing a processing state of said 
second message used during a second processing lifetime of said second message, 
said second set of rules used in obtaining second data related to said second message 
(see col.3, line 53-65 and col.4, lines 1 1-25), said first processing lifetime and said 
second processing lifetime overlapping for at least a portion of both lifetimes such that 
said first and second messages are concurrently processed (see col.1, lines 21-24). 
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As per claims 44 and 86, Post teaches of further comprising: gathering data in 
accordance with said first message and said first set of one or more rules; and 
gathering data in accordance with said second message and said second set of one or 
more rules (see Fig.1 and col.3, lines 53-65). 

As per claims 45 and 87, teaches further comprising: determining, after 
processing said first message, whether a first data storage area storing said first context 
information can be reused by determining whether a set of rules included in said first 
data storage area is said current set of rules; determining, after processing said second 
message, whether a second data storage area storing said second context information 
can be reused by determining whether a set of rules included in said second data 
storage area is said current set of rules; and designating said second data storage area 
for reuse and not designating said first data storage area for reuse (inherent: see col. 4, 
lines 3-5). 

As per claims 46 and 88, teaches of further comprising: receiving a third 
message; determining whether there are any available data storage areas designated 
for reuse; and selecting one of said available data storage areas if there are any 
available and otherwise allocating additional storage for storing third context information 
for said third message, said third context information including a copy of said current set 
of rules (subjective: see col .9, lines 33-47). 

As per claim 94, Post further teaches wherein said current set of rules are 
dynamically evaluated for each received message (see col.6, lines 10-25). 
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As per claim 96, Post teaches of further comprising: setting a current set of rules 
to be the first set of rules; and replacing the first set of rules with the second set of rules 
as the current set of rules (see Fig.3, steps 314-320). 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

7. Claims 4-7, 18-19, 50-53, 64-65, and 93 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Post (US 5,822,527 A) in view of Lui et al. (US 6,340,977 B1). 

As per claims 4, 50, and 93, Post further teaches wherein said message is a first 
message and the method further comprising: a portion of a processing lifetime of said 
first message overlapping at least a portion of a processing lifetime of said second 
message (see col.1 , lines 21-24), each of said processing lifetimes being a time period 
during which an associated message is processed to gather data (implicit: see col .8, 
lines 13-18). Post does not explicitly teach associating a first session structure with said 
first message from said data stream, said first session structure including a 
representation of said first set of rules (implicit: see col. 3, lines 53-65); and associating 
a second session structure with a second message from said data stream, said second 
session structure including a representation of said second set of rules (implicit: see 
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col.3, lines 53-65). Lui teaches associating a first session structure with said first 
message from said data stream and associating a second session structure with a 

» 

second message from said data stream (see col .40, lines 11-16). It would have been 
obvious to a person of ordinary skill in the art at the time the invention was made to 
employ the teachings of Lui within the system of Post by implementing associating 
session structure with coinciding messages within the data filtering distributed 
computing system because Lui teaches that sessions are established to determine 
usage patterns for a particular user so that procedures can be automatically built and 
later used thereby making the application program more efficient (see col .7, lines 62- 
col.8, line 12) and further adds that such implementation allows for data structures to be 
organized by "containing all link and connective information such that traversal actions, 
symbolic representations, and other operations can be processed or generated" (see 
col.40, lines 7-15). 

As per claims 5 and 51 , Post and Lui further teach wherein processing of said 
first message is complete and the method further comprising: determining if said first set 
of rules included in said first session structure (see claim 4 rejection above) is a current 
set of rules (see Fig.3, steps 314-320); and designating said first session structure (see 
claim 4 rejection above) for reuse in processing another incoming message if said first 
set of rules is said current set of rules (inherent: see col.4, lines 3-5). 

As per claims 6 and 52, Post and Lui teaches further comprising: receiving said 
second message; determining whether there are any existing session structures (see 
claim 4 rejection above) designated for reuse; and selecting one of said existing session 
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structures if there are any available for reuse (inherent: see col .4, lines 3-5), otherwise 
creating a new instance of a session structure for use in processing said second 
message (see col .5, line 65-col.6, line 16). 

As per claims 7 and 53, Post and Lui teaches of further comprising: using said 
current set of rules when creating a new instance of a session structure (subjective: see 
col.4, lines 3-5). 

As per claims 18 and 64, Post and Lui further teaches wherein processing a 
received message only synchronizes with processing of another received message 
when accessing a structure that includes one or more session objects for reuse and in 
connection with a globally accessed resource (see col. 9, lines 12-32). 

As per claims 19 and 65, Post further teaches wherein said globally accessed 
resource is a resource requiring serial access (see col.1 t lines 21-24). 

8. Claims 14 and 60 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Post (US 5,822,527 A) in view of Win et al. (US 6,161,139 A). Post teaches all the 
limitations of claims 14 and 60 except wherein said at least one compliance condition 
includes a predetermined number of unauthorized accesses. Win teaches of a 
condition including a predetermined number of unauthorized accesses (see col. 10, lines 
12-18). It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to employ the teachings of Win within the system of Post by 
implementing a predetermined number of unauthorized accesses condition within the 
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data filtering distributed computing system because the condition(s) for filtering is 
subjective and does not patentably distinguish the claimed invention. 

9. Claims 37, 38, 83, and 84 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Post (US 5,822,527 A) in view of Todd et al. (US 6,742,059 B1 ). 
Post teaches all the limitations of claims 37, 38, 83, and 84 except wherein said event 
log is a Windows event log and wherein said system log is a UNIX syslog. Todd 
teaches wherein said event log is a Windows event log and wherein said system log is a 
UNIX syslog (see col.2, lines 31-35). It would have been obvious to a person of 
ordinary skill in the art at the time the invention was made to employ the teachings of 
Todd within the system of Post by implementing Windows event log and Unix syslog 
within the data filtering distributed computing system because Todd teaches that such 
logging is "critical for systems administrator software which may be experiencing 
problems on a server and which needs to correlate" problems to peripherals (see col.2, 
lines 35-38). Therefore, such logging is vital in determining problems and/or issues of 
the filtering device and addressing these problems and/or issues to the administrator. 

Allowable Subject Matter 

10. Claims 20 and 66 are objected to as being dependent upon a rejected base 
claim, but would be allowable if rewritten in independent form including all of the 
limitations of the base claim and any intervening claims. 
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The following is an examiner's statement of reasons for allowance: 
Prior art of record Post (US 5,822,527 A), Lui et al. (US 6,340,977 B1), Win et al. 
(US 6,161,139 A), and Todd et al. (US 6,742,059 B1), do not disclose, teach, or suggest 
of further comprising: receiving said first set of rules in one or more messages; parsing 
said first set of rules producing a representation; traversing said representation to 
construct one or more temporary definitions of objects in accordance with said first set 
of rules; attempting to instantiate one or more objects in accordance with said one or 
more temporary definitions; determining whether an error has occurred in connection 
with said attempting to instantiate; and if no error has occurred in connection with said 
attempting to instantiate, defining said first set of rules as said current set of rules as 
recited in claims 20 and 66. 

Claims 21-23 and 67-69 are objected to as being dependent upon objected 
allowable claims 20 and 66, respectively. 

Conclusion 

1 1 . Claims 1-19, 24-65, and 70-97 have been rejected and claims 20-23 and 66-69 
have been objected. 

12. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Michael Y Won whose telephone number is 571-272- 
3993. The examiner can normally be reached on M-Th: 7AM-5PM. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Hosain T Alam can be reached on 571-272-3978. The fax phone number 
for the organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 

Michael Won 





February 15, 2005 



SUPERVISORY PATENT EXAMINER 
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